SMB Write permissions for subdirectories

[jv4r]

Write permissions works for only top level share directories, not for subdirectories.

For example on HTB: Garfield Box, NetExec didn't show write permission for SYSVOL, but scripts folder in SYSVOL had write permission..

Can you please add this feature..
Thank you..

[illmob]

havent checked but are the slashes wrong?

[NeffIsBack]

Thanks for the issue submission.

Yeah the --shares flag only enumerates the top level share permission and not all subfolders. I am not sure what a good approach would be that enumerates these permissions tho. Maybe something like "spidering for permissions"? Anyone ideas?

Thanks for the issue submission.

Yeah the --shares flag only enumerates the top level share permission and not all subfolders. I am not sure what a good approach would be that enumerates these permissions tho. Maybe something like "spidering for permissions"? Anyone ideas?

We can validate effective ACLs with smbcacls:

➜ smbcacls //garfield.htb/NETLOGON '/' -U 'j.arbuckle%Th1sD4mnC4t!@1978'
REVISION:1
CONTROL:SR|PD|DI|DP
OWNER:BUILTIN\Administrators
GROUP:NT AUTHORITY\SYSTEM
ACL:CREATOR OWNER:ALLOWED/OI|CI|IO/FULL
ACL:NT AUTHORITY\Authenticated Users:ALLOWED/OI|CI/READ
ACL:NT AUTHORITY\SYSTEM:ALLOWED/OI|CI/FULL
ACL:BUILTIN\Administrators:ALLOWED/OI|CI|IO/FULL
ACL:BUILTIN\Administrators:ALLOWED/0x0/RWXPO
ACL:BUILTIN\Server Operators:ALLOWED/OI|CI/READ
ACL:GARFIELD\IT Support:ALLOWED/OI|CI/RWXD

➜ smbcacls //garfield.htb/SYSVOL 'garfield.htb/scripts' -U 'j.arbuckle%Th1sD4mnC4t!@1978'
REVISION:1
CONTROL:SR|PD|DI|DP
OWNER:BUILTIN\Administrators
GROUP:NT AUTHORITY\SYSTEM
ACL:CREATOR OWNER:ALLOWED/OI|CI|IO/FULL
ACL:NT AUTHORITY\Authenticated Users:ALLOWED/OI|CI/READ
ACL:NT AUTHORITY\SYSTEM:ALLOWED/OI|CI/FULL
ACL:BUILTIN\Administrators:ALLOWED/OI|CI|IO/FULL
ACL:BUILTIN\Administrators:ALLOWED/0x0/RWXPO
ACL:BUILTIN\Server Operators:ALLOWED/OI|CI/READ
ACL:GARFIELD\IT Support:ALLOWED/OI|CI/RWXD

[xmp00]

Thanks for the issue submission.
Yeah the --shares flag only enumerates the top level share permission and not all subfolders. I am not sure what a good approach would be that enumerates these permissions tho. Maybe something like "spidering for permissions"? Anyone ideas?

We can validate effective ACLs with smbcacls:

➜ smbcacls //garfield.htb/NETLOGON '/' -U 'j.arbuckle%Th1sD4mnC4t!@1978'
REVISION:1
CONTROL:SR|PD|DI|DP
OWNER:BUILTIN\Administrators
GROUP:NT AUTHORITY\SYSTEM
ACL:CREATOR OWNER:ALLOWED/OI|CI|IO/FULL
ACL:NT AUTHORITY\Authenticated Users:ALLOWED/OI|CI/READ
ACL:NT AUTHORITY\SYSTEM:ALLOWED/OI|CI/FULL
ACL:BUILTIN\Administrators:ALLOWED/OI|CI|IO/FULL
ACL:BUILTIN\Administrators:ALLOWED/0x0/RWXPO
ACL:BUILTIN\Server Operators:ALLOWED/OI|CI/READ
ACL:GARFIELD\IT Support:ALLOWED/OI|CI/RWXD

➜ smbcacls //garfield.htb/SYSVOL 'garfield.htb/scripts' -U 'j.arbuckle%Th1sD4mnC4t!@1978'
REVISION:1
CONTROL:SR|PD|DI|DP
OWNER:BUILTIN\Administrators
GROUP:NT AUTHORITY\SYSTEM
ACL:CREATOR OWNER:ALLOWED/OI|CI|IO/FULL
ACL:NT AUTHORITY\Authenticated Users:ALLOWED/OI|CI/READ
ACL:NT AUTHORITY\SYSTEM:ALLOWED/OI|CI/FULL
ACL:BUILTIN\Administrators:ALLOWED/OI|CI|IO/FULL
ACL:BUILTIN\Administrators:ALLOWED/0x0/RWXPO
ACL:BUILTIN\Server Operators:ALLOWED/OI|CI/READ
ACL:GARFIELD\IT Support:ALLOWED/OI|CI/RWXD

Thanks for sharing.